You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/features/sso/index.mdx
+22-4Lines changed: 22 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,16 +14,31 @@ Open WebUI supports several forms of federated authentication:
14
14
1. OIDC
15
15
1. Trusted Header
16
16
17
+
:::info
18
+
19
+
For more information about all environment variables, check out the [environment variable docs page](https://docs.openwebui.com/getting-started/env-configuration/).
20
+
It is highly recommended to check the environment variable page, to get more details about how to set the variable and what values are expected.
21
+
22
+
:::
23
+
24
+
:::danger
25
+
26
+
Right now, you can only configure one OAUTH provider at a time.
27
+
You cannot have Microsoft **and** Google as providers simultaneously.
28
+
29
+
:::
30
+
17
31
## OAuth
18
32
19
-
There are several global configuration options for OAuth:
33
+
There are several global configuration options for OAuth in general:
20
34
21
35
1.`ENABLE_OAUTH_SIGNUP` - if `true`, allows accounts to be created when logging in with OAuth. Distinct from `ENABLE_SIGNUP`.
22
36
1.`OAUTH_MERGE_ACCOUNTS_BY_EMAIL` - allows logging into an account that matches the email address provided by the OAuth provider.
23
37
- This is considered insecure as not all OAuth providers verify email addresses, and may allow accounts to be hijacked.
24
38
1.`OAUTH_UPDATE_PICTURE_ON_LOGIN` - if `true`, users will have OAuth-provided profile pictures updated on login.
25
39
- If the OAuth picture claim is disabled by setting `OAUTH_PICTURE_CLAIM` to the empty string, this configuration will be ignored.
26
40
1.`OAUTH_PICTURE_CLAIM` - can be used to customize or disable profile picture storage. The default, `picture`, will work for most providers; if set to the empty string, all users will receive the default person profile picture.
41
+
1.`WEBUI_AUTH_SIGNOUT_REDIRECT_URI` - can be set to optionally forward the user to a specific URI after logging out.
27
42
28
43
### Google
29
44
@@ -34,6 +49,7 @@ The following environment variables are required:
34
49
35
50
1.`GOOGLE_CLIENT_ID` - Google OAuth client ID
36
51
1.`GOOGLE_CLIENT_SECRET` - Google OAuth client secret
52
+
1.`OPENID_PROVIDER_URL` - Must be set for logout to work properly.
37
53
38
54
### Microsoft
39
55
@@ -45,9 +61,10 @@ Support for Microsoft OAuth is currently limited to a single tenant, that is a s
45
61
The following environment variables are required:
46
62
47
63
1.`MICROSOFT_CLIENT_ID` - Microsoft OAuth client ID
48
-
2.`MICROSOFT_CLIENT_SECRET` - Microsoft OAuth client secret
49
-
3.`MICROSOFT_CLIENT_TENANT_ID` - Microsoft tenant ID - use `9188040d-6c67-4c5b-b112-36a304b66dad` for personal accounts
50
-
4.`MICROSOFT_REDIRECT_URI` - The redirect URI configured in your Microsoft OAuth application. This must be set to `<open-webui>/oauth/microsoft/callback`.
64
+
1.`MICROSOFT_CLIENT_SECRET` - Microsoft OAuth client secret
65
+
1.`MICROSOFT_CLIENT_TENANT_ID` - Microsoft tenant ID - use `9188040d-6c67-4c5b-b112-36a304b66dad` for personal accounts
66
+
1.`MICROSOFT_REDIRECT_URI` - The redirect URI configured in your Microsoft OAuth application. This must be set to `<open-webui>/oauth/microsoft/callback`.
67
+
1.`OPENID_PROVIDER_URL` - Must be set for logout to work properly.
51
68
52
69
### Github
53
70
@@ -58,6 +75,7 @@ The following environment variables are required:
0 commit comments